End-to-End Principle Brad Karp UCL Computer Science CS 6007/GC15/GA07 25 th February, 2009

2 Motivation: End-to-End Argument 7 layers in OSI model 7 places to solve many of same problems: –In-order delivery –Duplicate-free delivery –Reliable delivery (retransmission) after corruption or loss –Encryption –Authentication In which layer(s) should a particular function be implemented?

3 Example: Careful File Transfer Goal: accurately copy file on A’s disk to B’s disk Straw man: –Read file from A’s disk –A sends stream of packets containing file data to B –Link-layer retransmission of lost/corrupted packets at each hop –B writes file data to disk Does this system meet design goal? –Bit errors on links not a problem AR1R2R3R4B data LL ACKs

4 Where Can Errors Happen? On A’s or B’s disk In A’s or B’s RAM or CPU In A’s or B’s software In the RAM, CPU, or software of any router that forwards packet (MIT example!) Why might errors be likely? –Drive for CPU speed and storage density: pushes hardware to EE limits, engineered to tight tolerances –e.g., today’s disks return data that are the output of an MLE!

5 Solution: End-to-End Verification A stores checksum with data on disk –Why not compute freshly on read? B computes checksum over received data, sends to A (or vice-versa) Compare two checksums; A resends if not identical Can we eliminate hop-by-hop error detection? –Suppose there’s a router with bad RAM; how will you find it? Is a whole-file checksum enough? –Poor performance: must resend whole file each time one packet (bit) corrupted!

6 End-to-End Principle Only application at communication endpoints can completely and correctly implement a function Processing in middle alone cannot provide function Processing in middle may, however, be important performance optimization Engineering middle hops to provide guaranteed functionality often wasteful of effort and inefficient

7 Perils of Low-Layer Implementation Entangles application behavior with network internals Suppose each IP router reliably transmits to next hop –lossless delivery, variable delay –ftp: OK, move huge file reliably (just end-to-end TCP works fine, too, though) –Skype: terrible, jitter packets when a few corruptions or drops not a problem anyway Complicates deployment of innovative applications –phone network vs. Internet

8 Advantages of Low-Layer Implementation Each application author needn’t recode a shared function Overlapping error checks (e.g., checksums) at all layers invaluable in debugging and fault diagnosis If end systems not cooperative (increasingly the case), only way to enforce resource allocation!

9 Challenge: End-to-End Authentication and Encryption Use a public PC to check your using IMAP & SSL –Authenticates server to you and you to server robustly –Encrypts between you robustly Key security consideration: threat model –which attacks are you explicitly defending against? –which are you ignoring? –what does it cost your adversary to mount an attack? What are you trusting? –mail reading application (could be trojaned) –OS (could also be trojaned) –hardware (e.g., "fake ATM" cases) End-to-end notion of security must consider integrity of software and hardware at endpoints, possibly even of users!

10 End-to-End Violation: Firewalls Box in middle of network that blocks “malicious” traffic –End-host software often vulnerable to worms –Users naive, may not keep desktop patched up-to-date Clearly violates e2e principle –Endpoints capable of deciding what traffic to ignore –Firewall entangled with design of network and higher protocol layers and apps, and vice-versa –Example: new ECN bit to improve TCP congestion control; many firewalls filtered all such packets! Probably need firewalls But beware entangling network edge and network interior Our network X Firewall Internet

11 Summary: End-to-End Principle Many functions must be implemented at application endpoints to provide desired behavior, even if implemented in “middle” of network End-to-end approach decouples design of components in network interior from design of applications at edges Some functions still benefit from implementation in network interior; at cost of entangling interior and core –Performance (e.g., link-layer retransmission) –Security (e.g., firewalls) –Scalability (e.g., routing) End-to-end principle is not sacred; it’s a way to think critically about design choices in communication systems